types

type AccessControl struct {
	AllowedIPs []string // IP whitelist (CIDR notation, e.g., "192.168.1.0/24")
	DeniedIPs  []string // IP blacklist (CIDR notation)
}

type Cluster struct {
	ID            string
	CreatedAt     time.Time
	Managers      []*Node
	Workers       []*Node
	NetworkConfig *NetworkConfig
}

type DeployStrategy string

type Event struct {
	Type      string
	Timestamp time.Time
	NodeID    string
	ServiceID string
	TaskID    string
	Message   string
	Data      map[string]string
}

type HeaderManipulation struct {
	Add    map[string]string // Headers to add (e.g., {"X-Custom": "value"})
	Set    map[string]string // Headers to set/overwrite (e.g., {"X-Frame-Options": "DENY"})
	Remove []string          // Headers to remove (e.g., ["X-Powered-By"])
}

type HealthCheck struct {
	Type     HealthCheckType // "http", "tcp", "exec"
	Endpoint string          // URL or address
	Command  []string        // For exec type
	Interval time.Duration
	Timeout  time.Duration
	Retries  int
}

type HealthCheckType string

type HealthStatus struct {
	Healthy              bool
	Message              string
	CheckedAt            time.Time
	ConsecutiveFailures  int
	ConsecutiveSuccesses int
}

type Ingress struct {
	ID        string
	Name      string
	Rules     []*IngressRule
	TLS       *IngressTLS
	Labels    map[string]string
	CreatedAt time.Time
	UpdatedAt time.Time
}

type IngressBackend struct {
	ServiceName string // Service to route to
	Port        int    // Service port to connect to
}

type IngressPath struct {
	Path          string              // Path to match (e.g., "/api", "/web")
	PathType      PathType            // "Prefix" or "Exact"
	Backend       *IngressBackend     // Backend service to route to
	Rewrite       *PathRewrite        // Path rewriting configuration (M7.3)
	Headers       *HeaderManipulation // Header manipulation (M7.3)
	RateLimit     *RateLimit          // Rate limiting configuration (M7.3)
	AccessControl *AccessControl      // Access control rules (M7.3)
}

type IngressRule struct {
	Host  string         // Hostname to match (e.g., "api.example.com", "*.example.com")
	Paths []*IngressPath // Path-based routing rules
}

type IngressTLS struct {
	Enabled    bool     // Enable HTTPS
	SecretName string   // Secret containing TLS cert/key (PEM format)
	Hosts      []string // Hosts covered by this TLS config
	AutoTLS    bool     // Enable Let's Encrypt automatic certificates (M7.3)
	Email      string   // Email for Let's Encrypt notifications (M7.3)
}

type Network struct {
	ID      string
	Name    string
	Subnet  string // CIDR (e.g., "10.0.1.0/24")
	Gateway string
	Driver  string // "wireguard"
}

type NetworkConfig struct {
	ClusterSubnet string            // Overall cluster subnet (e.g., "10.0.0.0/16")
	ServiceSubnet string            // Subnet for service VIPs (e.g., "10.0.1.0/24")
	NodeIPs       map[string]net.IP // Node ID -> Overlay IP mapping
}

type Node struct {
	ID            string
	Role          NodeRole
	Address       string // Host IP address
	OverlayIP     net.IP // WireGuard overlay IP
	Hostname      string
	Labels        map[string]string
	Resources     *NodeResources
	Status        NodeStatus
	LastHeartbeat time.Time
	CreatedAt     time.Time
}

type NodeResources struct {
	// Total capacity
	CPUCores    int
	MemoryBytes int64
	DiskBytes   int64

	// Currently allocated (reserved by tasks)
	CPUAllocated    float64
	MemoryAllocated int64
	DiskAllocated   int64
}

type NodeRole string

type NodeStatus string

type PathRewrite struct {
	StripPrefix string // Strip this prefix from the path (e.g., "/api/v1" → "/")
	ReplacePath string // Replace entire path with this (takes precedence over StripPrefix)
}

type PathType string

type PortMapping struct {
	Name          string
	ContainerPort int         // Port inside container (target port)
	HostPort      int         // Port on host/cluster (published port)
	Protocol      string      // "tcp" or "udp"
	PublishMode   PublishMode // "host" or "ingress"
}

type PublishMode string

type RateLimit struct {
	RequestsPerSecond float64 // Requests allowed per second
	Burst             int     // Burst capacity (token bucket size)
}

type ResourceRequirements struct {
	// Limits (maximum allowed)
	CPULimit    float64 // Cores (e.g., 0.5 = 50% of one core)
	MemoryLimit int64   // Bytes

	// Reservations (guaranteed minimum)
	CPUReservation    float64
	MemoryReservation int64
}

type RestartCondition string

type RestartPolicy struct {
	Condition   RestartCondition
	MaxAttempts int
	Delay       time.Duration
}

type Secret struct {
	ID        string
	Name      string
	Data      []byte // Encrypted with AES-256-GCM
	CreatedAt time.Time
	UpdatedAt time.Time
}

type Service struct {
	ID             string
	Name           string
	Image          string
	Replicas       int
	Mode           ServiceMode
	DeployStrategy DeployStrategy
	UpdateConfig   *UpdateConfig
	Env            []string
	Ports          []*PortMapping
	Networks       []string
	Secrets        []string
	Volumes        []*VolumeMount
	Labels         map[string]string
	HealthCheck    *HealthCheck
	RestartPolicy  *RestartPolicy
	Resources      *ResourceRequirements
	StopTimeout    int // Seconds to wait before force-killing tasks (default: 10)
	CreatedAt      time.Time
	UpdatedAt      time.Time
}

type ServiceMode string

type TLSCertificate struct {
	ID        string            // Unique identifier
	Name      string            // Certificate name (e.g., "example-com-cert")
	Hosts     []string          // Hostnames covered by this cert (e.g., ["example.com", "*.example.com"])
	CertPEM   []byte            // Certificate in PEM format
	KeyPEM    []byte            // Private key in PEM format (encrypted in storage)
	Issuer    string            // Certificate issuer (e.g., "Let's Encrypt", "self-signed", "manual")
	NotBefore time.Time         // Certificate valid from
	NotAfter  time.Time         // Certificate valid until
	AutoRenew bool              // Enable automatic renewal (M7.3)
	Labels    map[string]string // Labels for organization
	CreatedAt time.Time
	UpdatedAt time.Time
}

type Task struct {
	ID            string
	ServiceID     string
	ServiceName   string
	NodeID        string
	ContainerID   string
	DesiredState  TaskState
	ActualState   TaskState
	Image         string
	Env           []string
	Ports         []*PortMapping
	Mounts        []*VolumeMount
	Secrets       []string // Secret names to mount
	HealthCheck   *HealthCheck
	HealthStatus  *HealthStatus // Current health check status
	RestartPolicy *RestartPolicy
	Resources     *ResourceRequirements
	StopTimeout   int // Seconds to wait before force-killing (default: 10)
	CreatedAt     time.Time
	StartedAt     time.Time
	FinishedAt    time.Time
	ExitCode      int
	Error         string
}

type TaskState string

type UpdateConfig struct {
	Parallelism   int           // How many tasks to update simultaneously
	Delay         time.Duration // Delay between batches
	FailureAction string        // "pause", "rollback", "continue"
	CanaryWeight  int           // 0-100 (for canary strategy)
}

type Volume struct {
	ID        string
	Name      string
	Driver    string            // "local", "nfs", etc.
	NodeID    string            // Node affinity (for local volumes)
	MountPath string            // Host mount path
	Options   map[string]string // Driver-specific options
	CreatedAt time.Time
}

type VolumeMount struct {
	Source   string // Volume name
	Target   string // Container path
	ReadOnly bool
}